wifi: cfg80211: avoid nontransmitted BSS list corruption

commit d89c7e97dff1d00c81c8cd8af8c5682793cc8b8c upstream.

If a non-transmitted BSS shares enough information (both
SSID and BSSID!) with another non-transmitted BSS of a
different AP, then we can find and update it, and then
try to add it to the non-transmitted BSS list. We do a
search for it on the transmitted BSS, but if it's not
there (but belongs to another transmitted BSS), the list
gets corrupted.

Since this is an erroneous situation, simply fail the
list insertion in this case and free the non-transmitted
BSS.

This fixes CVE-2022-42721.

Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: b397b5577905 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 30077be03192c14605b8563caa34580930b7981b..1a4110c283f971ea2b2b41116b5260875c75e619 100644 (file)
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -386,6 +386,15 @@ cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
 
        rcu_read_unlock();
 
+       /*
+        * This is a bit weird - it's not on the list, but already on another
+        * one! The only way that could happen is if there's some BSSID/SSID
+        * shared by multiple APs in their multi-BSSID profiles, potentially
+        * with hidden SSID mixed in ... ignore it.
+        */
+       if (!list_empty(&nontrans_bss->nontrans_list))
+               return -EINVAL;
+
        /* add to the list */
        list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
        return 0;